KVM: rename hardware_[dis|en]able() to *_nolock() and add locking wrappers